False “Defender Antivirus Is Turned Off” Alerts Spread Across Windows Versions

The alerts appear at startup and intermittently thereafter, and they ignore system-wide notification settings. The issue does not affect Windows 7, which no longer receives Defender updates.

Windows 11 is warning “Virus protection is off,” Microsoft confirms it’s false, but verify if Defender is actually enabled

The Windows Security app, which manages Defender, randomly displays a “Turn on virus protection” banner that redirects users to the Home tab of the app. Clicking the banner has no effect because real-time protection is already enabled. The notification persists in the Action Center and can reappear after dismissal. Microsoft’s internal documentation notes that any Windows or Windows Server installation with Defender enabled may encounter the bug, provided the antivirus is not paused.

Windows 11 is warning “Virus protection is off,” Microsoft confirms it’s false, but verify if Defender is actually enabled ForbesWindows 11 is warning people that Defender Antivirus has been turned off, but don't worry, says Microsoft

Microsoft confirmed that the alerts are a bug introduced by the latest Defender update and that the antivirus continues to function correctly. Software engineer Jen Gentleman, who is with Microsoft, said the company began investigating the problem about two weeks prior to the public acknowledgment.

Windows 11 is warning people that Defender Antivirus has been turned off, but don't worry, says Microsoft

• “It’s only natural to be a little bit worried,” — XDA-Developers

Forbes

Microsoft’s support document indicates that a corrective update is forthcoming, though no specific release date has been announced. Users are advised to verify Defender status via the Windows Security app or by running `sc query WinDefend` or the PowerShell command `Get-MpComputerStatus` to confirm that real-time protection remains enabled while awaiting the patch.

Windows 11 is warning “Virus protection is off,” Microsoft confirms it’s false, but verify if Defender is actually enabled